SQ new website breach of privacy

[tofuchicken]

Hi,

Let me start by saying how helpful the sqtalk forum has been in planning my next big trip.

Recently booked a J redemption ADL to CDG for Jan 2012 via the SQ website. Booking it went smoothly enough, paid my taxes and got my ticket. A few days later I was in the "manage bookings" section seeing what BTC options were available, seats etc. I scrolled down to the Passport Information section in the Passenger Details part, I noticed that although my first name and last name were listed correctly; the date of birth, nationality, Passport number, gender, Country of residence, Expiry date of passport, email address, and mobile phone number belonged to someone else from Japan.

I rang Krisflyer and got them to correct it immediately. I've already read how there are many glitches with the new website like not being able to access certain services or flight info etc, but an actual breach of privacy is on a whole different level. In the day and age of identity theft and IT security breaches, my confidence in singapore airlines is a little shaken specially considering the amount of information involved. My greatest concern is that someone else is looking at my personal information.

Krisflyer's response has been underwhelming

We are sorry for the inconvenience and disappointment caused as we are currently experiencing technical difficulties on our website.

Our technical team is already aware of this and they are already investigating and making further improvements to the website.

We hope you will bear with us.

Has this happened to anyone else? Should I take any further action and if so, which Australian authority?

[globetrekker84]

Okay that's scary.

[Gunnar Smithsen]

Has this happened to anyone else? Should I take any further action and if so, which Australian authority?

Today Tonight or aCA perhaps... Matthew White and Tracy Grimshaw would be juicing up over this kind of indecent act.. Oh sorry you asked for "which authority" apologies...

I'm sure the AFP, ASIO or DSD would be quite interested in this development but probably not for your benefit...

With the state of the website the way it is, who's to say that those details you saw on your screen actually all matched up to the one person?

Did you call the Japanese mobile number out of curiousity?

[Jamiegutz]

Very worrying indeed. As your ticket was issued in Aus then i am sure Aussie Data Protection law would apply, but as it is someone elses data being shared (i.e. not yours) then not sure how you stand. I guess if you can prove that your data has been shared with someone else as well then there would be grounds for further action. Really it should be the japanese passenger who should be pursuing this and it may well be worth getting in touch.

[SQueeze]

Hi,

Let me start by saying how helpful the sqtalk forum has been in planning my next big trip.

Recently booked a J redemption ADL to CDG for Jan 2012 via the SQ website. Booking it went smoothly enough, paid my taxes and got my ticket. A few days later I was in the "manage bookings" section seeing what BTC options were available, seats etc. I scrolled down to the Passport Information section in the Passenger Details part, I noticed that although my first name and last name were listed correctly; the date of birth, nationality, Passport number, gender, Country of residence, Expiry date of passport, email address, and mobile phone number belonged to someone else from Japan.

I rang Krisflyer and got them to correct it immediately. I've already read how
there are many glitches with the new website like not being able to access certain services or flight info etc, but an actual breach of privacy is on a whole different level. In the day and age of identity theft and IT security breaches, my confidence in singapore airlines is a little shaken specially considering the amount of information involved. My greatest concern is that someone else is looking at my personal information.

Krisflyer's response has been underwhelming

Has this happened to anyone else? Should I take any further action and if so, which Australian authority?

It hasn't happened to me personally but it has happened to someone I know. Details provided in her account were also that of a Japanese.

[KeithMEL]

I'm not 100% sure that an Australian authority will have jurisdiction over SQ's website, but the ACMA or the Privacy Commissioner would be the most appropriate regulators to take this to.

http://www.acma.gov.au/WEB/HOMEPAGE/PC=HOME
http://www.privacy.gov.au/

[cscs1956]

Hi,

Let me start by saying how helpful the sqtalk forum has been in planning my next big trip.

Recently booked a J redemption ADL to CDG for Jan 2012 via the SQ website. Booking it went smoothly enough, paid my taxes and got my ticket. A few days later I was in the "manage bookings" section seeing what BTC options were available, seats etc. I scrolled down to the Passport Information section in the Passenger Details part, I noticed that although my first name and last name were listed correctly; the date of birth, nationality, Passport number, gender, Country of residence, Expiry date of passport, email address, and mobile phone number belonged to someone else from Japan.

I rang Krisflyer and got them to correct it immediately. I've already read how there are many glitches with the new website like not being able to access certain services or flight info etc, but an actual breach of privacy is on a whole different level. In the day and age of identity theft and IT security breaches, my confidence in singapore airlines is a little shaken specially considering the amount of information involved. My greatest concern is that someone else is looking at my personal information.

Krisflyer's response has been underwhelming



Has this happened to anyone else? Should I take any further action and if so, which Australian authority?

Lucky SIA does not run bank !
Mke sure you have a screen capture, you can take it to relative department to complain.

[tofuchicken]

Just thought I'd give a quick update.

Its been about 4 weeks since the original stuff up, and the Japanese girl's details are still listed in my passenger details in the "manage bookings" section.

Decided to go to my local SIA office, and the girl there was quite helpful. She assured me that my details in the official ticket reservation system were correct and that I wouldn't have any trouble traveling. However when I showed her what my booking looked like through the SQ website, she was quite shocked and would report the incident to IT department. She sent me an email later that day

I just wanted to let you know I have reported your incident to our IT
department in Singapore. I am still waiting for a response from them but
as soon as I get one I will let you know. I have advised them of your
legitimate concerns and they will do all possible to ensure the problem is
fixed as soon as possible.

I will be in touch.

Kind regards,
Sue

Still worried my details are floating around somewhere...doubt i'll get an answer on that.

[9V-SKF]

Shocking amateurish! Never expect such sub standard service from SQ. I wouldn't be surprised if a lawsuit takes place over this issue. Just thought the Tiger Australia's issue was bad enough , this is just as bad if not worse.

[jbflyer]

What I understand Japan have strict law in personal information protection.
I remember that I had requested ANA staffs to help me to post my ANA mileage club membership application form. They were rejected at the first place and they explained that the application form has all my personal information, they shall not handle it on my behalf.
I wonder if someone lodge a complaint to Japanese authorities, what will be the impact to SQ.

[qantas_flyer]

Hi,

Let me start by saying how helpful the sqtalk forum has been in planning my next big trip.

Recently booked a J redemption ADL to CDG for Jan 2012 via the SQ website. Booking it went smoothly enough, paid my taxes and got my ticket. A few days later I was in the "manage bookings" section seeing what BTC options were available, seats etc. I scrolled down to the Passport Information section in the Passenger Details part, I noticed that although my first name and last name were listed correctly; the date of birth, nationality, Passport number, gender, Country of residence, Expiry date of passport, email address, and mobile phone number belonged to someone else from Japan.

I rang Krisflyer and got them to correct it immediately. I've already read how there are many glitches with the new website like not being able to access certain services or flight info etc, but an actual breach of privacy is on a whole different level. In the day and age of identity theft and IT security breaches, my confidence in singapore airlines is a little shaken specially considering the amount of information involved. My greatest concern is that someone else is looking at my personal information.

Krisflyer's response has been underwhelming



Has this happened to anyone else? Should I take any further action and if so, which Australian authority?

I don't mean to be cynical, but what did you expect Singapore Airlines to do other than write you an email? Unless you contact your local privacy commissioner, or law enforcement authority, it seems retrospect to complain here and not tackle to the situation further. Yes it is bad and unprofessional on Singapore Airlines' part, but you did bring it to their attention and they did action your complaint and that in itself is admirable by a company that is larger than most. Usually in many cases, your complaint would not have even validated a response from a complany as large as Singapore Airlines. I say thank you to Singapore Airlines for hearing your complaint.

[tofuchicken]

I don't mean to be cynical, but what did you expect Singapore Airlines to do other than write you an email? Unless you contact your local privacy commissioner, or law enforcement authority, it seems retrospect to complain here and not tackle to the situation further. Yes it is bad and unprofessional on Singapore Airlines' part, but you did bring it to their attention and they did action your complaint and that in itself is admirable by a company that is larger than most. Usually in many cases, your complaint would not have even validated a response from a complany as large as Singapore Airlines. I say thank you to Singapore Airlines for hearing your complaint.

What i want singapore airlines to do is to fix the error and after 4 weeks, the error still exists on the website.

I posted this thread to find out whether anyone else had experienced this problem before or was it just an isolated incident. I'm just sharing my experience with this situation. Hopefully it'll get fixed soon.

[SQ228]

I don't mean to be cynical, but what did you expect Singapore Airlines to do other than write you an email? Unless you contact your local privacy commissioner, or law enforcement authority, it seems retrospect to complain here and not tackle to the situation further. Yes it is bad and unprofessional on Singapore Airlines' part, but you did bring it to their attention and they did action your complaint and that in itself is admirable by a company that is larger than most. Usually in many cases, your complaint would not have even validated a response from a complany as large as Singapore Airlines. I say thank you to Singapore Airlines for hearing your complaint.

Just because a company is large does not give it any special concessions on matters of privacy. No, they didn't action the complaint, they sent an auto-generated email. Four weeks later nothing is fixed and so further action had to be taken by the customer.

I'm sorry, but if a company has grown so large that it can't receive a serious privacy breach alert from a customer and do more than send weak generic email, then it is a sign that its bureaucracy is sadly failing. I see nothing that warrants any kind of thanks in that.

[ozdude]

What i want singapore airlines to do is to fix the error and after 4 weeks, the error still exists on the website.

I posted this thread to find out whether anyone else had experienced this problem before or was it just an isolated incident. I'm just sharing my experience with this situation. Hopefully it'll get fixed soon.

It is clear that SQ are not responding in a timely manner. In your situation you should take it to the authorities, or the papers. No point being upset at SQ's reaction when you can still escalate it.

Privacy breaches are big issues, take it to an authority.

[Gunnar Smithsen]

ozdude,

This is SQ not QF, the media in Australia will give it a paragraph or two somewhere in the back...

Today Tonight or aCA on the other hand will eat this up!